Ivanti fixes two Connect Secure security flaws abused in active zero-day exploit chains

Ivanti has released security updates addressing two additional vulnerabilities in its Connect Secure remote access gateways. The issues, identified as CVE-2026-111357 and CVE-2026-118527, have been linked to zero-day attacks and were recently added to the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog. Threat actors previously chained the pair alongside an authentication bypass vulnerability, CVE-2026-104935, which Ivanti patched last month. [1][2]

Of the two newly resolved flaws, CVE-2026-111357 is a high-severity privilege escalation vulnerability, while CVE-2026-118527 permits authenticated actors to upload files onto an unpatched device. According to cybersecurity firm Volexity, a threat actor designated UTA0576 chained these bugs to secure unauthenticated root-level code execution on fully patched appliances without installing malware or web shells. Instead, the actor executed commands by re-exploiting the target and altering system logs to bypass Ivanti's Integrity Checker Tool. [1]

Threat intelligence firm Defused noted that active exploitation of the initial bypass began as early as October 1. Shadowserver currently tracks over 5,000 Internet-exposed Connect Secure instances, though it remains undetermined how many have applied the necessary fixes. CISA has now cataloged 38 Ivanti security flaws as actively exploited in the wild since November 2021, with 12 tied to ransomware operations. [1]